Vulnerability · Published Jun 12, 2026 · Assigned by GitHub_M
CVE-2026-44892Netty has a Vulnerable Default Configuration Which Leads to Denial of Service via Unbounded HTTP/3 Header Size
High 7.5
In plain English
A high-severity uncontrolled resource consumption in netty from netty. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, the default configuration of the `Http3ConnectionHandler` in the Netty HTTP/3 codec lacks an enforced maximum header size limit. When a peer does not explicitly specify `HTTP3_SETTINGS_MAX_FIELD_SECTION_SIZE`, the implementation defaults to an unbounded limit. This insecure default configuration allows a malicious client or server to send an enormous number of headers, leading to a memory exhaustion Denial of Service via an `OutOfMemoryError`. Version 4.2.15.Final contains a patch.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | netty | no fix listed | DEBIAN-CVE-2026-44892 |
| Debian:13 | netty | no fix listed | DEBIAN-CVE-2026-44892 |
| Debian:14 | netty | no fix listed | DEBIAN-CVE-2026-44892 |
| Maven | io.netty:netty-codec-http3 | 4.2.15.Final | GHSA-c2rx-5r8w-8xr2 |
| Ubuntu:25.10 | netty | no fix listed | UBUNTU-CVE-2026-44892 |
| Ubuntu:26.10 | netty | no fix listed | UBUNTU-CVE-2026-44892 |
Affected products (as reported)
Weakness: CWE-400, CWE-1188 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/netty/netty/security/advisories/GHSA-c2rx-5r8w-8xr2 x_refsource_CONFIRM
- https://github.com/netty/netty/releases/tag/netty-4.2.15.Final x_refsource_MISC